The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/task_runner.py utility includes a run_with_timeout function that executes arbitrary shell commands using subprocess.run(shell=True). This is a high-risk pattern that allows for command injection if the input commands are influenced by untrusted data or user input without rigorous sanitization.
[CREDENTIALS_UNSAFE]: The skill is designed to manage and persist sensitive credentials. It stores browser session cookies, localStorage values, and API keys for CAPTCHA solving services (2Captcha, Anti-Captcha, CapSolver) in the ~/.clawdbot/ directory. If the local system is compromised, this provides an attacker with a centralized repository of authenticated sessions and service keys.
[EXTERNAL_DOWNLOADS]: The skill documentation (SKILL.md) and scripts (scripts/cf_bypass.py) recommend and provide commands to download and run the FlareSolverr Docker container (ghcr.io/flaresolverr/flaresolverr). While this is a known tool for Cloudflare bypass, it involves executing external code/containers on the host system.
[INDIRECT_PROMPT_INJECTION]: Because the skill is designed to navigate and extract data from arbitrary websites (including those attempting to evade detection), it creates a significant attack surface for indirect prompt injection. Malicious instructions embedded in the HTML or metadata of a target website could potentially be ingested and acted upon by the AI agent during the automation process.
[DYNAMIC_EXECUTION]: Multiple scripts, including scripts/solve_captcha.py and scripts/login_session.py, use page.run_js() or page.execute_script() to inject tokens and manipulate the browser's JavaScript environment. This involves the runtime execution of dynamically generated code strings within the browser session context.

stealth-browser